fix(P01): SessionMiddleware kwargs — https_only/same_site (not secure/samesite)

Starlette SessionMiddleware uses `https_only` (not `secure`), `same_site`
(not `samesite`), and has no `httponly` kwarg (httponly is always true for
session cookies). The previous kwargs raised TypeError at middleware stack
build time. Cookie semantics are unchanged: https_only=secure flag,
same_site=strict, max_age=28800 (8h), session_cookie=praxis_op.

---ci---
project: praxis
phase: 1
milestone: v0.4
status: execute
persona: security-engineer
task: 03-02-fix
requirements:
  covered: [REQ-AUTH-01, REQ-NFR-AUTH-01]
---/ci---

server/auth/cookies.py

@@ -59,9 +59,8 @@ def get_session_middleware_kwargs() -> dict:
         "secret_key": secret,
         "session_cookie": "praxis_op",
         "max_age": _COOKIE_MAX_AGE_S,
-        "httponly": True,
+        "https_only": secure,
-        "samesite": "strict",
+        "same_site": "strict",
-        "secure": secure,
         "path": "/",
     }
 

tests/test_auth.py

@@ -68,9 +68,10 @@ def test_cookie_kwargs_defaults(monkeypatch):
     kw = get_session_middleware_kwargs()
     assert kw["session_cookie"] == "praxis_op"
     assert kw["max_age"] == 28800
-    assert kw["httponly"] is True
+    # Starlette SessionMiddleware: https_only (not secure), same_site (not samesite),
-    assert kw["samesite"] == "strict"
+    # httponly is always True (no kwarg). path is the cookie path.
-    assert kw["secure"] is True
+    assert kw["https_only"] is True
+    assert kw["same_site"] == "strict"
     assert kw["path"] == "/"
 
 
@@ -78,7 +79,7 @@ def test_cookie_secure_false(monkeypatch):
     monkeypatch.setenv("PRAXIS_COOKIE_SECRET", "x" * 48)
     monkeypatch.setenv("PRAXIS_COOKIE_SECURE", "false")
     kw = get_session_middleware_kwargs()
-    assert kw["secure"] is False
+    assert kw["https_only"] is False
 
 
 def test_cookie_secret_unset_generates_random(monkeypatch):